iptables DNAT arrives on non-bridged should go out bridged (oh oh the pain)

This seems like it should be a simple thing but I've spent four hours on it
with no joy.  It's safe to assume it's over my head.

I have a cable modem on eth0 and a lan on eth1 -- i.e., physical devices.
Recently, I added an openvpn tap0 to the mix.  I bridged eth1 and tap0 as
br0 and everything has been working peachy, except my DNATs from eth0.  Used
to be pretty trivial to forward things from eth0 to eth1 like so:

iptables -t nat -A PREROUTING -p tcp --dport 5121 -j DNAT --to
$somewhere_on_eth1

For 5121 traffic on the tap0, I hear the packets on eth1 and on br0 as
expected (tcpdump), but for 5121 traffic comming in on eth0; although it
appears to get re-written properly (dst-ip and dst-mac), it only goes out on
br0 and not the physical dev eth1 -- meaning the other hosts on the lan do
not hear the traffic.

I figure there's a simple but esoteric thing to tell ebtables so the kernel
will know to bridge the traffic and not just tell itself about it on br0,
but I haven't yet found that command.

-- 
If riding in an airplane is flying, then riding in a boat is swimming.

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user